1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
|
#!/bin/sh
cat << 'EOF'
rawnix.org Installation Guide - https://rawnix.org/handbook
Network:
Ethernet starts automatically.
WiFi: wpa_passphrase "SSID" "pass" > /tmp/wpa.conf
wpa_supplicant -B -i wlan0 -c /tmp/wpa.conf && dhcpcd wlan0
Partition:
fdisk /dev/sdX 1: EFI System, 1G rest: as you like
mkfs.fat -F32 /dev/sdX1
--- Unencrypted -------------------------------------------------
mkfs.ext4 /dev/sdX2
mount /dev/sdX2 /mnt
--- Encrypted ---------------------------------------------------
genluks formats, opens, mkfs's and mounts every volume in one go,
then gives each non-root volume a keyfile on the encrypted root.
One passphrase at boot: the initramfs unlocks root, and stage 1
opens the rest from the keyfiles.
genluks /mnt /dev/sdX2:/
genluks /mnt /dev/sdX2:/ /dev/sdX3:/var /dev/sdX6:/home /dev/sdX8:swap
genluks /mnt /dev/sdX2:/ /dev/sdX9:/data2:plain,xfs
<target> a path, or the bare word "swap" (not a mountpoint)
<opts> comma-separated: plain (no encryption), and/or
ext4 | xfs | btrfs (default ext4)
ESP (both cases):
mkdir -p /mnt/boot/efi && mount /dev/sdX1 /mnt/boot/efi
Install:
setup-filesystem /mnt
setup-boot /mnt (writes the kernel cmdline)
install --target /mnt base (libs + core + opt + devel + kernel)
install --target /mnt core (libs + core + opt, no kernel)
install --target /mnt core kernel (the above + prebuilt kernel)
The kernel goes last on purpose: installing it runs depmod and then
limine-sync, which writes limine.conf on the ESP from what is in
/boot. Nothing else installs a bootloader.
fstab + chroot:
genfstab /mnt > /mnt/etc/fstab && enter-chroot /mnt
Inside chroot:
passwd root
echo myhostname > /etc/hostname
ln -sf /usr/share/zoneinfo/Region/City /etc/localtime
ports -u (before any other pkg command:
pkg seeds its dependency db on
first use and needs the tree)
Before rebooting:
cat /boot/efi/limine.conf (should list the kernel, with
cryptroot= if you encrypted)
ls /boot/efi (vmlinuz-*, tinyrd.img, EFI/)
cat /etc/crypttab (if you have extra volumes)
Verify EFI loader
efibootmgr or mount -t efivarfs efivarfs /sys/firmware/efi/efivars
efibootmgr
efibootmgr -c -d /dev/sda -p 1 -L "rawnix" -l '\EFI\BOOT\BOOTX64.EFI'
efibootmgr -v
Adding an encrypted volume to a running system:
cryptsetup luksFormat --type luks2 /dev/sdXn
cryptsetup open /dev/sdXn cdata && mkfs.ext4 /dev/mapper/cdata
mount /dev/mapper/cdata /data
genluks / (adds a keyfile and a crypttab
entry; safe to re-run)
genfstab / > /etc/fstab.new (then merge what you want)
EOF
|
